CVE-2022-24396: sap se sap focused run (simple diagnostics agent)
Vulnerability summary
CVE-2022-24396 is a high (CVSS 7.8) vulnerability in sap se sap focused run (simple diagnostics agent). EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 08-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Sap1 product
- simple_diagnostics_agent≥ 1.0, ≤ 1.57
Sap se1 product
- sap focused run (simple diagnostics agent)< >= 1.0 | < 1.58
2 vendors · 2 products